Bank Frauds, Cyber Safety and Customer Liability: RBI Rules

The correct answer is B, three working days. Under the Reserve Bank's circular of 6 July 2017, where the fault lies neither with the bank nor with the customer but somewhere else in the system, the customer's liability is nil if the unauthorised transaction is reported within three working days of receiving the bank's communication about it. The day on which that communication was received is excluded from the count, and working days follow the home branch's schedule.

Option A, one working day, is stricter than the rule and would leave many genuine victims uncovered. Option C, seven working days, is the outer edge of the limited liability window, where the customer does bear a capped amount, so it is the most attractive wrong answer. Option D, fifteen working days, has no place in the framework; a report after seven working days is dealt with under the bank's own board-approved policy. Fix the pair in mind: three days for zero liability, four to seven days for capped liability.

The correct answer is A, rupees 5,000. The Reserve Bank's liability table sets the lowest ceiling for Basic Savings Bank Deposit accounts, which are the no-frills accounts opened for financial inclusion, because their holders are the least able to absorb a loss. The customer pays the transaction value or five thousand rupees, whichever is lower, so a fraud of two thousand rupees costs the customer two thousand, not five.

Option B, rupees 10,000, is the ceiling for ordinary savings accounts, prepaid payment instruments and gift cards, current or overdraft accounts of micro and small enterprises, individual current accounts with a limit up to twenty five lakh rupees, and credit cards with a limit up to five lakh rupees. Option C, rupees 25,000, is the ceiling for other current, cash credit and overdraft accounts and for credit cards with a limit above five lakh rupees. Option D is wrong because zero liability needs a report within three working days.

The correct answer is C, ten working days. A shadow reversal is a provisional credit of the disputed amount into the customer's account. The circular requires the bank to make it within ten working days of the customer's notification, and specifically says the bank may not wait for any insurance claim of its own to be settled first. The idea is that the customer should not be out of pocket while the investigation runs.

Option A, three working days, is the reporting window for zero liability, not a bank deadline. Option B, seven working days, is the end of the limited liability window for the customer. Option D, thirty working days, is close to the thirty day period after which an unresolved complaint can be taken to the Reserve Bank's ombudsman, but it is not the shadow reversal deadline. Keep three timelines apart: three days and seven days for the customer, ten working days for the shadow reversal and ninety days for final resolution.

The correct answer is C, 90 days from the complaint. The circular requires every bank to have a board-approved policy fixing its own resolution period, and caps that period at ninety days from the date the complaint is received. If the bank cannot complete the exercise within ninety days, it must still compensate the customer as the circular prescribes, so delay does not work in the bank's favour.

Option A, 30 days, is the period after which a complaint not resolved by the bank can be taken to the Reserve Bank's ombudsman, which is a different deadline and a common source of confusion. Option B, 60 days, does not appear in this framework. Option D, 180 days, is far longer than the rule allows. Pairing helps: ten working days for the provisional credit, ninety days for the final decision, and thirty days of bank inaction before the ombudsman can be approached.

The correct answer is B, on the bank. The circular places the burden of proof squarely on the bank: if a bank says the customer is liable, it must establish that, rather than asking the customer to prove innocence. This matters because the bank holds the logs, the device records and the transaction trail, while the customer holds almost nothing, so putting the burden on the customer would make the protection meaningless.

Option A is the intuitive but wrong answer, and banks sometimes behave as though it were true, which is why the question is set. Option C is wrong because the police investigate the criminal offence; liability between the bank and its customer is a civil matter settled under the Reserve Bank's rules. Option D is wrong because a payment system operator such as a card network or the retail payments organisation is not a party to the customer's account relationship for this purpose.

The correct answer is C, the customer bears the loss till reporting and the bank bears the loss after reporting. Sharing a PIN, password or one-time password is treated as customer negligence, and in that case the circular makes the customer bear the whole loss up to the time the fraud is reported. The moment the report is made, the bank is on the hook for every further rupee, because it is then the bank's job to block the account and the instrument.

Option A is wrong because a customer who hands over a credential cannot pass the whole loss to the bank. Option B is the harsher reading that many candidates choose, but it ignores the second half of the rule and is the main trap in this question. Option D is wrong because the framework never prescribes an automatic equal split; liability depends on who was at fault and on how quickly the report came. The practical lesson is to report at once even when the mistake was one's own.

The correct answer is C, rupees 25,000. The highest ceiling in the table applies to other current, cash credit and overdraft accounts and to credit cards whose limit exceeds five lakh rupees. The logic of the table is that the bigger the account, the greater the amount a customer is expected to watch over, so the cap rises with the size of the facility.

Option A, rupees 5,000, applies only to Basic Savings Bank Deposit accounts. Option B, rupees 10,000, applies to ordinary savings accounts, prepaid payment instruments and gift cards, micro and small enterprise current accounts, individual current accounts with limits up to twenty five lakh rupees, and credit cards with limits up to five lakh rupees, so the five lakh limit is the dividing line between the ten thousand and twenty five thousand rows. Option D, rupees 50,000, does not appear anywhere in the table and is a pure distractor.

The correct answer is B, the Reserve Bank of India. Banks report frauds to the Reserve Bank, which keeps them in the Central Fraud Registry and makes the database searchable by banks. A lender can therefore check whether a borrower, promoter or firm is already linked to a fraud elsewhere before sanctioning credit, which closes the gap that allowed a defaulter to move from one bank to the next.

Option A, the Central Bureau of Investigation, investigates large frauds referred to it but does not maintain this registry. Option C, the Securities and Exchange Board of India, regulates securities markets and keeps its own records of market offences, not bank frauds. Option D, the Indian Banks Association, is an industry body and issues common guidance for banks but has no such statutory database. Along with the Central Fraud Registry, remember the Central Repository of Information on Large Credits, which tracks large exposures rather than frauds.

The correct answer is B, 1930. The number is run under the national cybercrime reporting arrangement of the Ministry of Home Affairs and is meant for the immediate reporting of financial cyber fraud, alongside the National Cyber Crime Reporting Portal. A call in the first hours lets the amount be traced and frozen in the accounts to which it has been transferred, which is why speed matters more here than paperwork.

Option A, 1091, is the women's helpline and is unrelated. Option C, 14448, is the Reserve Bank's own number for its ombudsman and consumer education arrangement, used for a complaint against a bank rather than for reporting a crime, which makes it a good distractor. Option D, 1800, is only the prefix used by toll-free numbers in India and is not a helpline by itself. Remember 1930 for cyber fraud and 14448 for the banking ombudsman.

The correct answer is C, Section 66D. This section punishes a person who, by means of any communication device or computer resource, cheats by personation, which is exactly what a phishing website or a caller pretending to be a bank officer does. It is the provision most often invoked in online banking fraud cases, along with the general cheating provisions of the criminal law.

Option A, Section 43, provides for compensation for damage to a computer or computer system and is a civil remedy rather than a criminal punishment. Option B, Section 66C, deals with identity theft, that is the dishonest use of another person's electronic signature, password or unique identification feature; it is closely related and is the main alternative that candidates pick. Option D, Section 72, punishes breach of confidentiality and privacy by a person who has secured access to records under the Act. Learn 66C for identity theft and 66D for cheating by personation.

The correct answer is B, rupees 50,000. Under the Positive Pay System the issuer of a high value cheque sends the bank the key details, such as date, beneficiary name and amount, through a channel like the mobile app or internet banking, and the paying bank matches those details before honouring the cheque. The system covers cheques of fifty thousand rupees and above, which is where cheque tampering is worth a fraudster's effort.

Option A, rupees 10,000, is below the threshold and would cover almost every cheque, defeating the purpose of focusing on high value instruments. Option C, rupees 2 lakh, does not appear in the arrangement. Option D, rupees 5 lakh, is the value from which banks may make the facility compulsory for their customers rather than optional, so it is a half-right answer and the main trap here. Remember fifty thousand as the coverage threshold and five lakh as the level at which a bank may insist on it.

The correct answer is B, the Reserve Bank Integrated Ombudsman Scheme, 2021. The scheme merged the separate ombudsman schemes for banks, for non-banking financial companies and for digital transactions into a single one nation one ombudsman arrangement, with a centralised centre to receive and process complaints in any language. A complaint costs the customer nothing, and it can be filed once the bank has failed to resolve the matter within thirty days or has rejected it.

Option A refers to the voluntary codes of fair treatment that banks commit to, which are not a redress forum of this kind. Option C, the deposit insurance scheme run by the Deposit Insurance and Credit Guarantee Corporation, protects deposits up to a prescribed limit if a bank fails, an entirely different purpose. Option D is not a Reserve Bank scheme for banking complaints. The ombudsman is the step after the bank's internal grievance machinery, not a substitute for it.